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Traditional studies of terrorist group beliavior |1] focus on 
questions of political motivation, strategic choices, organi- 
zational structure, and material support |2, 3, 4, 5^ 6, JJ, 
but say little about the basic laws that govern how the 
frequency and severity (number of deaths) of their at- 
tacks change over time. Here we study 3,143 fatal attacks 
carried out worldwide from 1968-2008 by 381 terrorist 
groups |9], and show that the frequency of a group's at- 
tacks accelerates along a universal trajectory, in which the 
time between attacks decreases according to a power law 
in the group's total experience; in contrast, attack sever- 
ity is independent of organizational experience and orga- 
nizational size. We show that the acceleration can be ex- 
plained by organizational growth, and suggest that terror- 
ist organizations may be best understood as firms whose 
primary product is political violence. These results are in- 
dependent of many commonly studied social and political 
factors, suggesting a fundamental law for the dynamics of 
terrorism and a new approach to understanding poUtical 
conflicts. 

High-quality empirical data on terrorist groups, such as 
their recruitment, fundraising, decision making, and organi- 
zational structure, are scarce, and the available sources are 
not typically amenable to scientific analysis jlOtl . However, 
good-quality data on the frequency and severity of their at- 
tacks do exist, and their systematic analysis can shed new light 
on which facets of terrorist group behavior are predictable and 
which are inherently contingent. Each record in our world- 
wide database of 3,143 fatal attacks includes its calendar 
date t, its severity x, and the name of the associated organiza- 
tion, if known (see Supplementary Information). 

For each group, we quantify the changes in the frequency 
and severity of a group's attacks over its lifetime using a de- 
velopment curve. This curve maps a group's behavior onto a 
common quantitative scale and facilitates the direct compari- 
son of different groups at similar points in their life histories. 
To construct this, we plot the behavioral variable, such as the 
time (days) between consecutive attacks At or the severity 
of an attack x, as a function of the group's maturity or experi- 
ence k, indexed here by the cumulative number of fatal attacks 
(Fig ID- Combining the developmental curves of many groups 
produces an aggregate picture of their behavioral dynamics, 
and allows us to extract the typical developmental trajectory 
of a terrorist group. 

Constructing a combined development curve for the 38 1 or- 
ganizations in our database, we find that the time between con- 
secutive attacks At changes in a highly regular way (Fig.|2^), 
while the severity of these attacks x is independent of organi- 
zational experience (Fig.|2};). 

Empirically, the time between attacks decreases quickly as 



a group gains experience. For example, the mean delay be- 
tween the first and second fatal attacks is almost six months, 
(At) = 168.6 ± 0.6 days, while after 13 attacks, the mean 
delay is only (At) = 27 ± 1 days. More generally, the enve- 
lope or distribution of delays p( At, k) can be characterized as 
a truncated log-normal distribution with constant variance 
and a characteristic delay between attacks /i that decreases 
systematically with experience k. Mathematically: 



p(log At, log k) oc exp 



-(logAt + /31ogfc-/^)2 
2^2 



(1) 



where (3 controls the trajectory of the distribution toward the 
natural cutoff at At = 1 day. For small k, i.e., during a 
group's early development, this model predicts a mean delay 
between attacks that decays like a power law At k, ^k^^; 
however, as k increases, this trend is attenuated as the mean 
delay asymptotes to At = 1 (see Supplementary Informa- 
tion). Under this model, (3=1 would indicate a simple lin- 
ear feedback between a group's attack rate and its experience. 
However, we find /3 = 1.10 ± 0.02, indicating a faster-than- 
linear feedback between the accumulation of experience and 
the rate of future attacks. 

This model successfully predicts that the distributions of 
normalized delays At k^^ will collapse onto a single log- 
normal distribution with parameters /t and a (Fig.|2j)). How- 
ever, individual attacks cannot be considered fully indepen- 
dent (p = 0.00 ± 0.03; see Supplementary Information), in- 
dicating that significant temporal or inter-group correlations 
may exist in the timing of a group's future attacks 1 1 1 ] (Fig.!!). 

In contrast, the severity of an attack x is independent 
of group experience k (Fig. |2};; r = —0.024, t-test, p = 
0.17), as illustrated by the collapse of the severity distribu- 
tions p(xlfc) onto a single invariant heavy-tailed distribu- 
tion OSl (Fig. |2}l; see Supplementary Information). For 
example, the mean severity of a group's first attack (x) = 
6.7 ± 0.9 is only slightly larger than the mean severity of all 
attacks by very experienced groups (fc > 100) (x) = 5.1±0.6. 
Thus, contrary to common assumptions, young and old groups 
are equally likely to produce extremely severe events. Older 
groups, however, remain significantly more lethal overall 

iii 

because they attack much more frequently than small groups, 
not because their individual attacks are more deadly. 

Here, we consider four explanations for the acceleration 
in the frequency of attacks: (i) organizational learning [icjl . 
(ii) organizational growth, (iii) sampling artifacts, and (iv) av- 
eraging artifacts fl4]. Organizational learning — commonly 
studied in manufacturing |15, 16] and called "learning by 
doing" — implies that terrorist groups are born clumsy and 
increase their attack rate primarily because their existing 
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FIG. 1 : Individual development curves. Time until the next fatal event At, and the severity of the event x, as a function of individual group 
experience k, for the four most experienced groups (Taliban, Revolutionary Armed Forces of Colombia (FARC), Liberation Tigers of Tamil 
Eelam (LTTE), and al Fatah), along with population-level curves derived from analyzing all groups together. Similar results hold for less 
experienced groups. 



members learn to be more efficient, e.g., better planning, 
coordination, and execution. In contrast, organizational 
growth implies that groups are born small and increase their 
attack rate primarily by recruiting new, replaceable, rela- 
tively independent members, e.g., adding new terrorist cells. 
Straightforward tests of the data can eliminate both artifactual 
explanations (see Supplementary Information), indicating that 
the acceleration is real, even at the level of an individual group 
(Fig.[B. 

The relative importance of organizational learning and or- 
ganizational growth cannot be estimated using frequency and 
severity data alone. Untangling their effects requires data both 
on event planning and execution, and on a group's size and 
recruitment at various points in its life history. To our knowl- 
edge, systematic data on event planning and execution do not 
exist. The best available data on group sizes, taken from an 
expert survey |13], are coarse (roughly order of magnitude) 
estimates of the maximum size achieved by each of the 381 
groups over the 1998-2005 period; of these 161 conducted at 
least one fatal attack, and 80 conducted at least two. 

The growth hypothesis predicts that a group's maximum 
size will be inversely related to the minimum delay between 
its attacks over the 1998-2005 period. An analysis of variance 
indicates that the average minimum delays in the four size cat- 
egories are significantly different (Fig. [3^; n-way ANOVA, 
F = 9.98, p < 0.000013), and further that larger organiza- 
tional size is a highly significant predictor of increased attack 
frequency (r — —0.49, t-test, p < 10^^). In contrast, size, 
like experience (Fig. |2};), is not a significant predictor of at- 
tack severity (Fig.[3]3; see Supplementary Information). 

Although operational, organizational, and political circum- 
stances vary widely across terrorist groups, the systematic na- 
ture of our results suggests several general conclusions. The 
strong dependence of attack frequency on experience (Fig.|2^) 
suggests that the timing of events is governed primarily by 
organizationally internal factors, like growth and learning. 



related to group development, e.g., recruitment, personnel 
turnover, and internal coordination. Our analysis of group 
sizes lends significant support to the growth hypothesis, but 
without additional data, we cannot eliminate the possibility 
that these groups are also learning. Even so, our results im- 
plicate these internal factors as leverage points for decreasing 
the incidence rate of future attacks. In contrast, internal fac- 
tors seem to play a marginal role in the severity of any par- 
ticular attack (Figs. 12}; and[3j'), implying that the lethality of 
larger and more mature groups 1 13] is explained by their more 
frequent activity rather than more deadly activity. Further, we 
note that curtailing the frequency of a group's attacks, perhaps 
by limiting growth, would reduce the cumulative risk of very 
severe attacks. 

Learning and growth may also constrain other behaviors, 
such as fundraising, resource availability, political motiva- 
tion ll6l [TtIi . strategic choices in timing 1, 18.1 and targets 
and the use of tactics like suicide bombs Jst] . However, most 
groups never achieve a high level of experience (k > 100), 
and it is unclear to what degree this leaky pipeline is caused 
by group death, e^., from counter-terrorism activities or in- 
ternal conflicts lfl9l I20I1 . versus shifts away from violence. 
Similarly, it is unclear whether or how these dynamics change 
when a group does become highly experienced. Once a group 
is large enough to execute almost daily attacks, it may be more 
like a social institution, and thus face different constraints and 
incentives than smaller, still developing groups. It is also un- 
clear what mechanism explains the power-law distribution in 
the severity of terrorist attacks jsl [12I1 . and its independence 
of organizational experience and size. Two possibilities are 
(i) the advantages and disadvantages of youth (small size and 
the element of surprise vs. poor resources and clumsy attacks) 
balance those of maturity (more resources and better plan- 
ning vs. risk aversion and hostile attention from governments), 
yielding apparent independence; and (ii) severity is inherently 
random, governed by contingent details associated with the 
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FIG. 2: Combined development curves, a, The mean delay (log At) between attacks by a terrorist group, with 25* and 75* percentile 
isoclines, as a function of group experience k. The solid line shows the expected mean delay, from the model described in the text, b, The 
distributions of normalized delays p{Atk^), showing the predicted data collapse onto an underlying log-normal distribution, c, The mean 
severity (log x) of fatal attacks by a terrorist group, with 25"^ and 75"^ percentile isoclines, as a function of group experience k. The solid 
line (with slope zero) shows the expected mean delay, from a simple regression model, d. The distributions of event severities Pr(X > x), 
showing the data collapse onto an underlying heavy-tailed distribution. 



particular attack, the particular group, etc. 

The development curves shown here are similar in form to 
production curves found in manufacturing in which per- 
item production costs tends to decrease like a power law in the 
cumulative number of items produced. In this light, terrorist 
groups may best be understood as firms whose principal prod- 
uct is political violence, and whose production rates depend 
largely on organizational growth and the availability of low- 
skill labor Thus, studies of event-driven, non-terrorist organi- 
zations, e.g., some non-profits, political activism groups, and 
commercial firms, could shed additional light on the dynam- 
ics of terrorist groups. A better understanding of how these 
groups are like, and unlike, non-terrorist human social groups 
may indicate which counter-terrorism policies, e.g., limiting 
growth by stifling recruitment or by forcing organizational 
turnover, are likely to be effective. 

Finally, we note that our results are independent of many 



commonly studied factors, including geographic location, 
time period, ideological motivations (religious, separatist, re- 
actionary, etc.), and political context. Some aspects of terror- 
ism are thus not nearly as contingent as is widely assumed, 
and quantifying dynamical patterns in political conflict can 
serve the broader goal of understanding what regularities ex- 
ist, why they exist, and what they imply for long-term social 
and political stability. 
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FIG. 3: Frequency and severity versus group size s. Box-plots of the distributions of a group's a, minimum delay log(min At) and b, 
median attack severity log(median x) for attacks over the period 1998-2005, within each of four estimated maximum size categories flsh . 
For convenience, we connect the means of each category, which are significantly different in the case of delays (n-way ANOVA, F — 9.98, 
p < 0.000013), but indistinguishable in the case of severities (n-way ANOVA, F = 0.59, p = 0.62). 
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FIG. Si: The severity distributions for attributed and unattributed 
events, along with maximum hkehhood power-law models for their 
tails. See Table lSll for details. 



APPENDIX A: TERRORISM DATA 
1. Events 

Many organizations track teiTorist events worldwide, but 
few provide their data in a form amenable to scientic anal- 
ysis. The most popular source of information on terrorist 
events in the political science literature is the ITERATE data 
set fsT], which focuses exclusively on transnational teiTorist 
events, i.e., events involving actors from at least two coun- 
tries. For the analysis of teiTorist groups, however, domes- 
tic events, i.e., events involving actors from only one coun- 
try, are equally relevant. Thus, we use the data contained in 
the National Memorial Institute for the Prevention of Terror- 
ism [82] database, which largely overlaps with the ITERATE 
data but also includes fully domestic terrorist events since at 
least 1998. 

The MIPT database combines the RAND Terrorism 
Chronology 1968-1997, the RAND-MIPT Terrorism Inci- 
dent database (1998-2008), the Terrorism Indictment database 
(University of Arkansas and University of Oklahoma), and 
DPI International's research on terrorist organizations. Since 
we last collected event data |S2], MIPT mandate was changed 
by the U.S. Department of Homeland Security such that main- 
taining and making publicly available this data was no longer 
a priority. Our understanding is that the MIPT data will 
eventually be merged with the Global Terrorism Database 
(GTD) managed by the START program, a U.S. Department 
of Homeland Security Center of Excellence, at the University 
of Maryland, College Park. 

Records in the MIPT database are derived by a team of 
specialized scholars from original sources, largely reports in 
newspapers worldwide, accessible via the LexusNexis service 
and other means. This human element presents the possibility 
that some records, particularly those corresponding to non- 
lethal events, could be missing or corrupted by poor report- 
ing issll . In order to mitigate the effect of such biases, we 



focus our analysis on the portion of the database that is most 
trustworthy [S4], namely those events that resulted in at least 
one fatality, since these events are typically reported more re- 
liably in the media jssl] . 

The MIPT database contains 35,688 recorded terrorist at- 
tacks worldwide from January 1968 to January 2008; these 
events occurred in almost 6,000 cities in over 180 nations. 
13,274 (37.2%) of the events resulted in at least one fatal- 
ity while 10,085 (28.3%) were attributed to one of 910 or- 
ganizations. The intersection of these criteria, i.e., events 
that were both fatal and attributed, includes 3,143 events at- 
tributed to 381 organizations. (106 such events were at- 
tributed to more than one organization; in our analysis, we 
give all groups credit for such an event.) This set of organi- 
zations includes most common ideological motivations, such 
as national-separatist, reactionary, religious, and revolution- 
ary ideologies ||S6»1 , and spans a wide variety of political con- 
texts. 

In some cases, groups carried out multiple attacks on the 
same day. For our analysis of the delay between consecutive 
attacks, these few cases present a difficulty by inducing a de- 
lay variable of At = 0. For simplicity, we combine such 
concurrent attacks into a single record with a severity equal to 
the sum of the fatalities of its component attacks. 



2. Organizations 

There are very few sources of systematic data on teiTorist 
organizations worldwide. The START program at the Univer- 
sity of Maryland currently hosts some data under their "Ter- 
rorist Organization Profiles" (TOPs) program; this data was 
originally developed by Detica, Inc., a British defense con- 
tractor, and was accessible from the MIPT from c.1998 to 
March 2008. Estimates of group sizes in this database are rel- 
atively few, and the methodology used to derive them opaque. 

Jones and Libicki, working at the RAND Corporation, com- 
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^min 


V 


Attributed 
Unattributed 


3,143 6.6 52.1 2749 
10,131 3.5 10.5 500 


10 ±3 2.24 ±0.12 
14 ±3 2.55 ±0.12 


0.78 ± 0.03 
0.19 ±0.03 


All events 


13,274 4.2 51.3 2749 


10 ±3 2.39 ±0.09 


0.39 ±0.03 



TABLE SI: Summary statistics, along with parameters and significance values for power-law tail models, for fatal terrorist events attributed 
and unattributed to some terrorist organization. 



piled a database of information on 649 teiTorist groups. This 
database includes estimates of the group's peak size over its 
entire lifetime |S7]. Unfortunately, the breadth of time over 
which the size estimate holds makes it difficult to tightly re- 
late size with behavior. 

Finally, Asal and Rethemeyer extracted data from the MIPT 
list of organizations and augmented it with data drawn from 
public sources and estimates from a panel of experts at the 
Monterey Institute of International Studies (MIIS) [S8]. This 
data provides coarse (roughly order of magnitude) estimates 
of maximum size over the 1998-2005 period. Given the care 
taken in constructing the Asal and Rethemeyer data, it appears 
to be the most accurate data on terrorist group sizes currently 
available. Of the groups they consider, 161 conducted at least 
one fatal attack over the 1998-2005 period, and 80 conducted 
at least two. For our analyses of group size (Appendix|E]), we 
consider the former set for questions of event severity, and the 
latter set for questions of event frequency. 



3. Attributed vs. unattributed events 

Because a large fraction of the MIPT events are not at- 
tributed to any particular terrorist organization, an important 
question is whether the unattributed events differ from the at- 
tributed events in important ways. For example, are attributed 
events systematically more severe than unattributed events? 
This might be the case if there were a systematic bias or in- 
centive for attacking organizations to be associated with their 
more severe events, perhaps to gain greater media attention. 
We can test for such a bias by separately considering the 
severity distributions for attributed and unattributed events in 
the MIPT database. Fig. IS II shows these distributions, along 
with their corresponding power-law fits; TablelSllsumm arizes 
these data and models. 

The results show that the attributed- and unattributed-event 
severity distributions are extremely similar. Their averages 
and standard deviations differ primarily because these are 
high-variance distributions, and the presence of a few very 
large attributed events drives outsized differences in these 
summary statistics. There are slight differences in the bod- 
ies (small a;, see Fig. lSll l. and the upper tails are almost iden- 
tical |'S9'l: both are plausibly distributed according to power 
laws and span largely indistinguishable ranges of severity, but 
have slightly different scaling exponents (Table lSTI ). Although 
we find some evidence for a very weak relationship between 
severity and attribution, our results imply that the severity of 
attributed and unattributed events do not differ in qualitatively 
important ways. 
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FIG. S2: The attack frequency development curves for groups whose 
first attack was a, in 1968-1997 or b, in 1998-2008, illustrating that 
the development curve progression for attack frequency is not merely 
a transnational or domestic phenomenon, and is robust to the change 
in the definition of the MIPT database in 1998. The expected mean 
delay shown here is taken from the main text, and thus serves as a 
reference point. 



There is no clear theoretical reason to expect that the delay 
between events At should be systematically related to attri- 
bution. However, because the development curve analysis de- 
scribed in Appendix |B] omits all of the events carried out by 
a group but which are not attributed to it, the empirical delay 
between consecutive attacks is at best an upper-bound on the 
true delay. (Unfortunately, it is unknown how the observed de- 
lay between attributed events relates to the true delay between 
consecutive events.) This implies that our estimate of the ac- 
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celeration of attack rates (characterized by /3) may overesti- 
mate its true value. The systematic patterns shown in Fig. [S3] 
and Fig.[S2]suggest that, unless they are highly pathologically 
distributed as a function of k, incorporating correctly labeled 
unattributed events is unlikely to fundamentally change our 
results. 



4. Domestic vs. transnational events 

The MIPT data has an important bias, due to its particu- 
lar maintenance history. From 1968-1997, the database was 
maintained by the RAND Corporation as part of its project on 
transnational terrorism. As a result, almost no domestic ter- 
rorist attacks are included before 1998, after which the scope 
of the database was significantly expanded (in part due to the 
Oklahoma City bombing in 1995) to include purely domestic 
events worldwide. Thus, an important check on the generality 
of our results is to ask whether the attack frequency develop- 
ment curves depend on mixing data across the critical 1998 
date. To test for this sensitivity, we construct combined de- 
velopment curves from events by groups whose first attack 
was before 1 January 1998 (mainly transnational groups), and 
separately from events by groups whose first attack was on 
or after 1 January 1998 (transnational and domestic groups). 
Groups in the MIPT database are not coded as being transna- 
tional or domestic, and adding such data is a highly non-trivial 
task for a database of this size. 

Figure|S2]shows that the development curve phenomenon is 
robust to this division of data. That being said, one difference 
is worth noting. The development curve for the 1968-1997 
data shows a much slower overall rate of acceleration than 
does the 1998-2008 curve. The origin of this difference may 
be related to the rise of religiously motivated terrorism in the 
1990s and beyond; however, sorting out its cause is beyond 
the scope of both this test and this study. For our purposes, 
it suffices to demonstrate that the development curve's overall 
form is robust to the MIPT's coverage bias. 



APPENDIX B: ATTACK FREQUENCY DEVELOPMENT 
CURVE MODEL 

This model comes from the observation that the distribu- 
tions of delays p{At, k) for different values of k collapse onto 
a single universal curve (Fig.|S3b) of the form 



p(log At, log k) = C exp 



C 



-(log At + 13 log k - 



2a2 



(Bl) 



1 - Erf 



fj log k-p, 



tV2 



where Erf is the error function and C is the normalization 
constant. In words, the logarithm of the delay is normally dis- 
tributed A/'(/i, <t) (or equivalently, the delay is log-normally 
distributed), but has a natural lower cutoff at A< = 1 day 
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FIG. S3: a. The mean delay (log At) between attacks by a terror- 
ist group, with 25**^ and 75"^ percentile isoclines, as a function of 
group experience k. The solid line shows the expected mean delay, 
from the model described in the text, b, The distributions of normal- 
ized delays p{Atk^), showing the predicted data collapse onto an 
underlying log-normal distribution. 



(which comes from the resolution of the recorded data) and a 
/i parameter that decreases systematically as k increases. The 
parameter /i denotes the characteristic delay between attacks, 
and in particular the delay between the first and second at- 
tacks, while denotes the variance in the expected delay. 
Due to the breadth of the log-normal distribution, a non-trivial 
value of a implies a wide degree of variability in the waiting 
time, even given the characteristic delay /z. By integrating, we 
can derive the expected mean delay from Eq. (IB lb . which has 
the form 



E[logAt] ^ n- l3\ogk 



exp 










^1 - Erf 


(3 log k—fi 
aV2 


) 



(B2) 



For small values of fc, the expected delay is dominated by 
the first two terms, and thus decays according to a power-law 
At w nk^^, where /i represents the initial rate of attack for a 
group. At larger values of fc, the expected delay is dominated 
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FIG. S4: Individual attack frequency development curves for the eight most experienced groups, along with the expected mean delay curve 
shown in Fig. lS3l (i.e.. the combined curve for all groups). Notably, there is no evidence of the threshold behavior predicted by the averaging 
hypothesis, or the universally low initial delay predicted by the sampling hypothesis; similar results hold for less experienced groups. 



by the third term in Eq. ( IB2l l. which makes the expected delay 
to approach At = 1 more slowly than a power law. 

The model's parameters /i, a and (3 can be estimated di- 
rectly from the data using standard numerical procedures (the 
simplex or Nelder-Mead method |S10], in this case) to max- 
imize the likelihood of the data. Standard error estimates for 
the parameters can then be numerically estimated using the 
method of Fisher information to approximate the width of th e 
log-likelihood function in the vicinity of the maximum ISl ill . 
Applying these methods to our data yields fi = 5.67 ± 0.05, 
(7 = 2.12 ± 0.02, and /? = 1.10 ± 0.02. The estimated value 
of f3 has particular significance: /3 = 1 indicates a simple lin- 
ear feedback between the gain in experience and the change in 
attack rate, with deviations above and below indicating super- 
and sub-linear feedback. The estimated (3 > 1, thus indicates 
super-linear feedback, which implies an explosive accelera- 
tion in the attack rate in finite time. However, this explosive 
growth is strongly attenuated by the third term in Eq. iB2i . 
which prevents the actual attack rate from reaching extremely 
high levels. 

Although desirable, estimates of individual group trajecto- 
ries are difficult to obtain using this procedure, due to a se- 
vere 0(A:* ) finite-size bias in the estimation of /i (where 
denotes the total number of attacks by the group), and 
slightly less severe biases in estimating a and /3. On the other 
hand, combining data from many groups yields a less severe 
0{n^^^^) bias in each parameter (where n is the total number 
of delays combined). For the combined development curve, 
we have n w 2500, and the finite-size bias is negligible (less 
than 0.1 for each parameter). 

Finally, we point out that very few groups (e.g., Hamas, 
Fatah, LTTE, FARC, etc.) manage to become highly experi- 
enced (k > 100). The sparsity of the data for large k means 
that the fit in this region is primarily controlled by the de- 
lays at much smaller values of k, where the vast majority of 
data lay (Fig. IS3b). This explains the slight misfit to the de- 



lays for highly experienced groups, relative to the empirical 
observations, and highlights the fact that the behavior of inex- 
perienced groups is predictive of the behavior of more mature 
groups. 



APPENDIX C: TESTS OF ATTACK DELAY 
DEVELOPMENT CURVE 

1. Averaging and sampling artifacts 

As described in the main text, there are several possible 
explanations for the observed universal development curve for 
the frequency of teiTori st att acks by a group. These are (i) 
organizational learning llS12ll . (ii) organizational grow th, (iii) 
sampling artifacts, and (iv) averaging artifacts [SIS']. Here 
we show that the sampling and averaging explanations can be 
eliminated using the available empirical data. 

In the sampling scenario, groups are born with some 
unique, but fixed, attack rate /ij. As each group progresses 
through its lifetime, groups with slower attack rates (larger 
fii) die out first. This implies that the maximum experience 
k^ achieved by a group should be inversely proportional to its 
attack rate /i^. The net result of sampling groups in this way 
is to leave progressively fewer groups with large iii values 
at larger experiences fc, which gives the illusion of a smooth 
trend toward faster attack rates. 

In the averaging scenario, groups can exhibit one of two 
attack frequencies: daily attacks (fast attackers) or attacks at 
some rate /i (slow attackers). Initially, all groups are slow 
attackers; however, at a group-specific experience threshold 
ko^i, they switch behaviors and become fast attackers. The 
individual development curve for such a group would be a 
step function. By combining many such step functions, each 
with a different step location fco,i, i.e., by averaging across the 
different thresholds, the combined development curve show a 
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smooth trend toward faster attack rates even though no indi- 
vidual group behaves that way. (As an aside: this averaging 
across thresholds model has been used to explain the appar- 
ently progressive learning curves for certain behaviors in ani- 
mals 1 S 1 3,1 and is thought to under ly so me evolved regulatory 
behaviors among eusocial insects 1151411 .') 

It is instructive to again use the factory analogy. In the case 
of selection artifacts, different factories have different intrin- 
sic production rates, but slower factories go out of business 
sooner, leaving a progressively larger fraction of fast factories 
at later times. Thus, although no factory exhibits a progres- 
sive trend toward faster production, as time passes, a larger 
fraction of the slow factories have died off, and the average 
rate of the remaining factories progressively increases. In the 
case of averaging artifacts, all factories begin with slow pro- 
duction rate, but at a randomly chosen time in the future, each 
switches from slow to fast production (due to a sudden insight 
or a sudden windfall profit). Thus, although no individual fac- 
tory exhibits a progressive trend toward faster production, as 
time passes, a larger fraction of factories have switched to the 
faster rate, and the average rate of all factories progressively 
increases. 

Both the sampling and averaging explanations can be tested 
using the available event frequency data. The sampling ex- 
planation predicts an inverse relationship between a group's 
characteristic attack rate /i; and its maturity fc^ .i (total number 
of attacks), i.e., groups with larger /li (slower attack rate) die 
out more quickly and thus should exhibit a smaller number of 
total events. Unfortunately, the finite-size bias mentioned in 
Appendix iB] prevents us from testing this prediction directly, 
by first estimating each group's /i^ via maximum likelihood 
and then testing if fii varies inversely with fc,.i. Instead, we 
must use a more indirect test. Here, we use the first delay vari- 
able for a group Ai|^^ as a proxy for the group's attack rate 
fii. Regressing each group's initial delay against its total ex- 
perience yields no significant relationship (r = —0.057, t-test, 
p = 0.46), and similarly for the logarithm of delay and expe- 
rience (r = —0.114, t-test, p = 0.14). (Notably, the empirical 
k^,,i underestimates the total number of attacks by a group for 
all groups still active today; however, this particular kind of 
bias is unlikely to transform an inverse relationship between 
A^l^'' and A:*,^ into the null relationship we observe here.) 

A strong test of the sampling explanation, which also tests 
the averaging hypothesis, is to plot the individual attack fre- 
quency development curves for the groups with the most fatal 
attacks. Fig.lS4lshows these curves for the eight most experi- 
enced groups in our database. Notably, none of these curves 
exhibits the predicted switching behavior (from low to high 
frequency) predicted by the averaging hypothesis, and very 
few (Islamic State of Iraq, and possibly al Qaeda in Iraq) ex- 
hibit extremely short initial delays; instead, each generally ex- 
hibits a progressive increase in attack rate, and similar results 
hold for less experienced groups. 

Thus, although the combined development curve may 
not represent precisely the development of any individual 
organization — and indeed, we see that individual groups do 
indeed deviate from the population trend (Fig. |S4| i — its gen- 
eral shape is an accurate description of the tendencies of each 
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FIG. S5: The numerically estimated distribution of p- values (4000 
reps.) for data drawn lid from the generative model described in 
Eq. dBlt . using the procedure described in Appendix IC 21 shown as 
a, the histogram with standard error estimates and b, the cumula- 
tive distribution function. The dashed line shows the null-model of a 
uniform distribution, and the estimated distribution's uniformity in- 
dicates that the Monte Carlo estimation of the p-value is unbiased. 
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2. Calculation of statistical significance; p-value 

We numerically estimate the statistical significance of the 
model given in Eq. (IB lb using a semiparametric Monte Carlo 
procedure. Under this procedure, we use the empirical expe- 
rience data {ki}, but generate new delay variables {Ati} by 
drawing them iid from the estimated model, conditioned on 
their corresponding ki value (see Appendix iBl). As the test 
statistic, we use the Kolmogorov-Smirnov distance LS15J be- 
tween the empirical data and the truncated log-normal distri- 
bution, averaged over experience variables: 

k 

i?* = -r^ |] niax|5fe(i)-PfcW| , (CI) 

n-max ^ 

where Sk{i) is the empirical distribution function for expe- 
rience k and Pk{i) is the corresponding theoretical cumula- 
tive distribution function. We average the KS distances, rather 
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FIG. S6: Individual attack severity development curves for the eight most experienced groups, along with the expected mean severity curve 
shown in Fig. lS7b . 



than, say, take their maximum, because the number of delays 
Uk observed at each value of k is roughly inversely propor- 
tional to fc, and when nk is small, the KS distance will be 
large, regardless of how well (or poorly) the model fits the 
data. The average KS distance avoids this problem. 

To calculate the p-value, we use the following procedure: 

1. estimate /i, a and /3 for the empirical {At^} data using 
maximum likelihood ; 

2. compute the empirical value of the test statistic D* 
(Eq. jCll l). relative to this model ; 

3. for j = 1 . . . repetitions (for N ^ 1), do the follow- 
ing: 

(a) for each event delay fc;, draw a new delay variable 
Ati independently fromp(Af | ki) (the model es- 
timated in step[T]i ; 

(b) estimate model parameters /ij, aj, and Pj from 
the data generated in step [3a]; 

(c) compute the test statistic D* for this same data 
(from step[3a]relative to its own estimated model, 
with parameters /ij, aj, and (3j, from step [3b]) ; 

4. the p- value is defined as the fraction of the test statistics 
D* that are at least as large as the empirical test statistic, 
i.e., D* > D*. 

To check that this choice of test statistic yields an unbi- 
ased p-value, we conducted a numerical experiment to mea- 
sure the distribution of p-values for data truly drawn iid from 
the model. To be unbiased, i.e., to have the correct interpre- 
tation as a probability that the data were in fact drawn from 
the null model, this distribution should be uniform on the unit 
interval. Fig.|S5|shows the results of this test, confirming that 
the test statistic D* is unbiased. 

When applied to the empirical delays, we estimate p = 
0.00 ± 0.03, indicating that the null model can be rejected. 



Because the normalized delay distributions p{k^ At) collapse 
onto the underlying log-normal distribution, however, this re- 
jection implicates the assumption of independence as being 
invalid, as opposed to the general form of the model, i.e., there 
are significant correlations in the timing of attacks. 



APPENDIX D: ANALYSIS OF ATTACK SEVERITY 
DEVELOPMENT CURVE 

Fig. [S6] shows the individual attack severity development 
curves for the same eight groups as in Fig. lS4l along with the 
population-level trend described below. Most notably, these 
individual development curves largely reflect the combined 
development curve result that experience and severity are in- 
dependent, even at the level of individual groups. 

Fig. |S7b repeats the attack severity developmental curve 
from the main text. The slope of a simple trend line (re- 
gressing log k against log x) is not distinguishable from zero 
(r = -0.0238, t-test, p = 0.17), and the solid line shows the 
zero-slope null hypothesis. Further, if we consider the distri- 
bution of severities at a particular value of k, we see that they 
do not seem to depend on k (Fig. lSTb ). and that they resemble 
power-laws distributions 054]] . Taking this similarity at face 
value, we can test whether the severity distribution p{x \ k) 
depends strongly on the group's experience k. Fig. [S8] (upper) 
shows the results of fitting each of the distributions p{x \ k) 
for the first 40 values of k with a power-law distribution with 

Xmin = 1 iH. 

The estimated power-law exponents are very stable: the 
correlation between oik and k is negligible (r = 0.0274, t- 
test, p = 0.87), and the average estimated value (ctk) = 1.74 
is indistinguishable from the estimated value for all the data 
together (i.e., ignoring fc), Aaii — 1.74 ± 0.01. Thus, the dis- 
tribution of attack severities appears to be independent of or- 
ganizational experience, i.e., the probability that an attack will 
cause X fatalities does not depend on the number of attacks k 
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FIG. S7: a, The mean severity (log a;) of fatal attacks by a terrorist 
group, with 25"^ and 75"^ percentile isoclines, as a function of group 
experience k. The solid line (with slope zero) shows the expected 
mean delay, from a simple regression model, b. The distributions 
of event severities Pr(X > x), showing the data collapse onto an 
underlying heavy-tailed distribution. 



a group has done in the past. 

This result has several implications for understanding the 
origin of the power-law form of the severities distribution 
for terrorist attacks worldwide llsil [S9tl . In so far as terror- 
ist attacks are characteristic of the more general category of 
asymmetric or guerrilla warfare, a model proposed by John- 
son et al. suggests that the severity power law comes from 
self-organized critical beh avior in the internal dynamics of ter- 
rorist organizations [iS16i lS17ll . Their model assumes that all 
groups are composed of a number of cells, and that these cells 
merge (pairwise) or fall apart (into individuals) according to 
a Markov process. Under these dynamics, the steady-state 
distribution of cell sizes can be sho wn to foll ow a power law 
under relatively general conditions lS18llS19ll . and by assum- 
ing that cells attack independently, at roughly equal rates, and 
induce fatalities in proportion to their size, this model yields a 
power- law distribution in the severity of attacks. 

The independence of event severity x and organizational 
experience k, however, suggests that this explanation requires 
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FIG. S8: Power-law analysis of event severities, for k < 40: (up- 
per) the maximum likelihood exponent & for a power-law distribu- 
tion with x^in ~ 1, and (lower), the corresponding p- value of the 
fit. The slope of the trend line in the upper panel is not statistically 
different from zero. 



additional assumptions to explain terrorist attack severities. 
For instance, we might assume that groups are born with a 
power-law distribution of cell sizes, as the model otherwise 
predicts an initial transient period of non-power-law behavior 
while the cells self-organize away from their initial state to- 
ward their steady state. This transient period should appear in 
our data as non-power-law behavior in the severity of events 
at small k, with the distribution at fc = 1 reflecting the distri- 
bution of initial cell sizes. 

However, Figs. |S7b .b and |S8] show that even for k ~ 1, 
we see power-law-like behavior This suggests that (i) terror- 
ist groups are not internally self-organized critical, (ii) groups 
converge to their steady-state distribution of cell sizes before 
making any attacks, or (iii) other assumptions (e.g., about the 
behavior of cells) conspire in a complicated way to neverthe- 
less produce a power-law distributions for small k. Common 
sense and historical evidence suggest that the second possibil- 
ity is probably not the case: most terrorist groups start out 
small and do n ot wait very long before beginning their at- 
tacks 

An important caveat to our stability analysis is that more of 
the 40 distributions tested above have p < 0.1 than we would 
expect from an iid situation (37% vs. 10%; Fig. IS7fa . lower). 
This implies that there is more structure (or more variance) 
in the severity data than the simple iid power-law hypothesis 
would lead us to expect. That is, there are likely significant 
correlations in the severity of subsequent attacks by the same 
group. One place this structure could be hiding is in the ex- 
treme right tail. 



APPENDIX E: ADDITIONAL ANALYSES OF GROUP SIZE 

On the question of how the frequency of attack varies with 
organizational size, in the main text, we argue that the min- 
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FIG. S9: Boxplots showing the distributions of a, mean, b, median and c, minimum delays between consecutive fatal attacks by groups in the 
1998-2005 period. In all cases, the trend shows that larger size is indicative of a faster attack rate. 



imum delay min At is the appropriate dependent variable to 
consider because the size estimate corresponds to the maxi- 
mum size over the 1998-2005 period. For completeness, we 
additionally considered whether the mean and median delays 
vary with group size, and found similar results (Fig. |S9l l. In 
all cases, the categorical means were significantly different 
(n-way ANOVA, F = 3.78 and p = 0.0139 for mean delay; 
F = 7.44 and p = 0.0002 for median delay), and the trends 
point in the same direction as for the minimum delay. That is, 
in all cases, larger organizational size is indicative of greater 
attack frequency. 

Similarly, we considered how the mean, median and maxi- 
mum severity of attacks varies with organizational size. Here, 
the mean and median severities are not related to organiza- 



tional size (n-way ANOVA, F = 1.14 and p = 0.3352 
for mean severity; F = 0.59 and p — 0.6219 for median 
severity). Only in the case of maximum severity do we find 
a significant relationship (n-way ANOVA, F — 4.53 and 
p — 0.0045); however, such a relationship is expected, given 
that larger groups attack much more frequently. That is, con- 
sider a situation in which the severity x of an attack is an iid 
random variable drawn from some distribution P. It is well 
known from extreme value theory that the expected maximum 
observed severity will increase monotonically with the num- 
ber of draws from P |, S22i1 . Thus, because larger groups at- 
tack more often, i.e., they have many more chances to produce 
a severe attack, a positive relationship between the maximum 
severity and group size is expected. 
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